Admission controller is used for mutating and validating OAM component, trait and application configuration. It is integrated with Kubernetes by Dynamic Admission Control.

Admission controller can provide web hook API for mutating and validating OAM spec, not only used by Rudr, it can be used by all OAM implementation for validation.

1. checking component/trait existence for AppConfig
2. check component/trait really have parameters or properties mentioned in AppConfig
3. invalidate if a worker tries to bind to a port
4. check component/trait/AppConfig format when created
5. check application scope format when created
6. check application scope instance when they created by AppConfig

1. resolve and mutate fromVariable() func in AppConfig

1. schema require or not: this could validate in CRD definition yaml.

Admission Controller need you to prepare certificates and ca, for none-production use, you cloud generate it by the shell script.

$ ./hack/gen_certs.sh

The script will generate the certificates in ./hack/_certs/

$ tree hack/_certs/
hack/_certs/
├── admission-crt.pem
├── admission-key.pem
├── admission.csr
├── ca.crt
├── ca.key
└── ca.srl

1. use ca created here fill with CaBundle in charts/values.yaml

cat charts/admission/values_template.yaml | sed 's/_CaBundle_/'"$(cat hack/_certs/ca.crt | base64 | tr -d '\n')"'/g' > charts/admission/values.yaml

2. create certificates for Admission Controller as K8s secrets

Notice: change namespace using the same namespace as helm installed

kubectl create secret generic admission-oam -n default \
        --from-file=key.pem=hack/_certs/admission-key.pem \
        --from-file=cert.pem=hack/_certs/admission-crt.pem

3. install charts by helm tool.

helm install admission ./charts/admission

It will automatically check Application Configuration and other OAM resources when they are created or modified.

1. make dependency to you vendor files build building docker image

go mod vendor

2. make sure code-generator in your vendor folder.

mkdir -p vendor/k8s.io
cd vendor/k8s.io
git clone [email protected]:kubernetes/code-generator.git